Midnight Mimosa Malware Infects Android Devices Before Boot-Up

Key Takeaways

• Midnight Mimosa is a new Android malware campaign found pre-installed in the firmware of low-cost MediaTek-based devices.
• The malware establishes a persistent foothold before the user even powers on the device, bypassing traditional security measures.
• Its primary objectives are financial gain through hidden advertising fraud and the creation of residential proxy networks.
• Bitdefender researchers observed thousands of infected devices across over 150 countries over two years.
• Removal requires firmware-level intervention, making device vendors and sellers crucial to remediation.

Midnight Mimosa: A Pre-Boot Android Threat

A sophisticated new malware, dubbed Midnight Mimosa, is compromising Android smartphones directly at the firmware level, granting attackers a persistent and covert presence even before users initiate their devices. This insidious method circumvents common infection vectors like malicious downloads, phishing attempts, or user-granted app permissions.

The campaign primarily targets budget-friendly Android devices powered by MediaTek chipsets from various manufacturers. Its core objective is to generate illicit revenue through deceptive advertising practices and by establishing residential proxy services. Furthermore, the malware’s deep system access enables its operators to silently install and uninstall applications, as well as load new code without user consent, as detailed in a comprehensive report.

Discovery and Scope of the Campaign

Security researchers at Bitdefender uncovered Midnight Mimosa after their App Anomaly Detection system flagged unusual behavior from a seemingly legitimate system package within the Android operating environment. The detailed malware research report by Bitdefender, released on October 8th and updated on October 9th, reveals that thousands of devices in more than 150 countries have been affected over an approximate two-year period. While Bitdefender’s telemetry provides significant insight, this figure represents their observed distribution rather than a definitive global count of infections.

The highest concentrations of affected devices were identified in Mexico, France, and Italy, followed by the United States, Germany, Brazil, and Spain. A notable observation was that some compromised devices reported counterfeit flagship model names, complicating the identification of the actual hardware and manufacturers.

How Midnight Mimosa Establishes Foothold

The investigation began with a deceptive system component labeled “System.” This component, signed with a platform certificate and operating with Android’s system user privileges, possessed the ability to install packages and grant permissions without any user interaction. Crucially, unlike standard applications, this firmware-embedded component cannot be removed through typical uninstall procedures available to users.

This method of delivery highlights a critical vulnerability within the device supply chain, shifting the burden of security from the end-user to the manufacturers and distributors. Previous incidents involving pre-installed malware demonstrate that relying solely on app-level security measures is insufficient when a trusted yet malicious system component is present from the point of sale.

The malware’s operational stealth is further enhanced by concealing much of its code within a native library. Upon device startup, this library decrypts an embedded APK using the RC4 algorithm and subsequently loads a hidden Java framework. This framework then proceeds to download additional DEX and JAR modules, providing the attackers with the flexibility to modify the phone’s behavior post-purchase. These modules are responsible for simulating ad clicks, managing app installations, and facilitating further downloads. To evade detection, some JAR files are stored with object-file extensions, and downloadable modules are disguised as PNG files. This multi-layered obfuscation makes it challenging to ascertain the malware’s full capabilities simply by analyzing the initial APK.

Hidden Ads and Proxy Traffic

Bitdefender’s analysis identified at least 32 distinct applications used in the broader operation, masquerading as legitimate tools such as weather utilities, app locks, file managers, and text scanners. The system component dynamically installs and removes these payloads, constantly altering the visible app inventory while maintaining the core firmware infection. This rotation helps to keep the malicious activity fresh and harder to trace.

The advertising revenue is generated through seemingly innocuous “cover apps” that integrate legitimate advertising SDKs. However, the malware orchestrates hidden impressions and clicks without any actual user engagement. Timing mechanisms are implemented to mimic natural user behavior, making the fraudulent traffic appear authentic. This technique aligns with findings from prior research into Android Phantom click fraud, which sheds light on similar tactics and infrastructure.

In addition to ad fraud, a specific fake app-lock payload has the capability to enroll the compromised phone into a residential proxy network. This allows remote operators to route their internet traffic through the infected device’s connection. While Bitdefender did not observe active traffic relaying during its testing of a fresh node, earlier investigations into BADBOX Android proxy malware underscore the significant risk of consumer devices being co-opted as network relays for malicious purposes.

To further avoid detection, the malware temporarily disables the Google Play Store package before installing its payloads, presumably to bypass Google Play Protect. It then re-enables the store when a user is actively present. Some malware samples even falsely report Google Play as their installer, despite lacking the official Google distribution signature. This tactic highlights that even official app stores are not immune to the indirect effects of sophisticated malware. The system component also requests extensive permissions, including Accessibility, notification access, and SMS capabilities. Although researchers observed these permissions being repeatedly enabled and disabled, they did not witness their use for data theft. However, the presence of these capabilities, combined with the ability to load remote code, suggests that operators could expand the campaign’s scope beyond mere advertising fraud in the future.

While some affected firmware utilized certificates bearing Shenzhen Zediel’s name, Bitdefender has not concluded that the company was directly involved in creating, approving, or knowingly distributing the malware. The exact point of entry into the supply chain remains undetermined. Effective remediation requires addressing the infection at the firmware level, as standard uninstall procedures cannot remove the persistent root component. Therefore, device manufacturers and sellers are pivotal in resolving this issue for affected devices. Bitdefender also issued a correction regarding an initial network finding, clarifying that an IP address previously thought to be a proxy command server was, in fact, a sinkhole and not confirmed attacker infrastructure.

Indicators of Compromise (IoCs)

Network, File, and Detection Indicators

Corrected Infrastructure Finding

Complete Published Sample Set: 120 MD5 Hashes

Additional MD5 Hashes Published in the Analysis

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What You Should Do

• Verify Device Provenance: Purchase Android devices only from reputable vendors and official channels to minimize the risk of receiving pre-infected firmware.
• Monitor for Anomalous Behavior: Be vigilant for unexpected app installations, unusual battery drain, excessive data usage, or unsolicited advertisements, which could indicate a compromise.
• Consider Factory Reset (with caution): For suspected infections where the malware is deeply embedded, a factory reset may not be sufficient. Consult with the device manufacturer or a cybersecurity professional.
• Demand Firmware Updates: If your device is identified as being affected, contact the manufacturer or seller to inquire about firmware updates that specifically address the Midnight Mimosa malware.
• Utilize Advanced Mobile Security: Deploy reputable mobile security solutions that include anomaly detection capabilities to identify suspicious system-level activities.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.